What to do with 6.7GB of logs from a http proxy used by someone to initiate attacks?

Question

Background:

I had experimented with nginx's proxy caching mechanisms one night to see if I could speed up a very slow website for a friend of mine -- this experiment went on late into the night, at what point I concluded it wasn't a viable option for what he wanted to do.

I forgot to disable the nginx proxy config and sometime later it was picked up by someone that they could use it to proxy all their requests via my server, without my noticing. It ran for about 3 months like this before I noticed and put an end to it.

So now I have a 6.7GB apache style log file, with >20 million entries that show over 180GB of traffic used for illicit purposes, showing the date, source IP and destination request.

What can I do with this that could be of benefit to the general internet community? Or is it useless?

Is it safe to publish it, or could that get me in trouble legally somehow? Are there any spam research centres who might benefit from it?

Edit: Just to clarify, the log is entirely that of the proxy'd requests.

Answer 1

Generally speaking, nobody cares about this. It's not like any law enforcement agency will sift through this data in hopes of finding anything. So sending it anywhere is absolutely pointless from this standpoint, except for the warm feeling that you "did a right thing". However:

1. Don't delete this data. In case some crime activity that went through your proxy gets investigated, this is your only evidence it wasn't you. So burn it into 2 DVDs and keep it safe.

2. You may want to (formally) report this to law enforcement if your local laws require it. I am not a lawyer and I don't know where you live. Just don't expect any real investigation.

3. Don't post this data anywhere since you don't really know what is inside. You may be held liable if you publish some innocent third party's private data.

Answer 2

Definitely keep a backup of the logs "AS-IS". If the perpetrator visited child porn or other illegal sites, law enforcement may knock on your door with a warrant for your arrest and possession of all your computers.

DO NOT post the logs anywhere. Lawyers will tell their clients to say nothing to law enforcement when questioned without legal counsel (even if the client feels they have nothing to hide and are being honest) because clients do not know the legal system and laws well enough to keep from providing law enforcement some motive, evidence or probable cause that may be used against them. Seek legal counsel before posting any log data.

See the Tor Legal FAQ for some helpful legal Q&A, especially the Exit Relays section. Also, the EFF Know Your Rights is worth the read.

Answer 3

http://www.justice.gov/criminal/cybercrime/reporting.htm

You could report it here, and spend 45 minutes filling out a report/complaint, or you can call on the phone, and get a human, and they can tell you what to do with it.

Because it takes 2 years for the goverment to do anything, if they ever thought you were part of it, you could be holding that for a long time. file a report, save the report, bag it and tag it :-)

Answer 4

Unless I was sure that they were used it to, as you say, "initiate attacks",I would ignore it. You have disabled it.